How to block port scans and brute force with iptables

Why standard firewalls fall short against modern bots

Keeping a server connected to the internet today is the digital equivalent of leaving your front door unlocked on a busy street. Within minutes, automated scripts running across infected computer networks start knocking on your digital doors, testing common passwords and looking for known flaws. For those managing Linux servers, iptables, the classic built-in tool for controlling network traffic, remains the first and most solid line of defense. In practice, it acts like a severe security guard who inspects the identity of every incoming data packet and decides whether it enters, gets ignored, or is summarily banned.

Many administrators rely solely on strong passwords or default application settings, forgetting that simply having a malicious bot spend hours trying to guess passwords consumes precious CPU and memory resources. When we combine port scans, which map out active services, with brute-force attacks that attempt to break credentials through sheer exhaustion, the server suffers unnecessary strain. As seen in practices for how to block brute force attacks in Nginx with IP rate limiting, edge containment drastically relieves the web application.

Understanding state tracking and established connections

To create smart firewall rules, we need to understand how Linux views a network conversation. The connection tracking module, known as conntrack, allows iptables to remember whether a packet is part of an ongoing conversation or a brand-new connection attempt. In practice, this means we can instantly accept packets from connections that were previously validated and approved, saving the processor from analyzing every single message exchanged during a long download or browsing session.

This approach reduces computational effort and prevents complex rules from being processed a thousand times per second for the same user. If you want to audit what is passing through your machine before applying drastic blocks, it is worth checking how to track active TCP connections on Linux with ss to identify suspicious flows in real time. With active state control, our master rule permits familiar traffic and rigorously inspects only new requests arriving at the SSH port or other exposed services.

How to identify and block ongoing port scans

Port scans work like a thief testing doorknobs across multiple rooms in an office to see which one is unlocked. To mitigate this aggressive behavior before it turns into a successful breach, we can use the iptables recent extension module. This feature creates a dynamic list of IP addresses that tried to access specific ports within a very short time interval, allowing the system to automatically quarantine them.

Below we present a practical procedure to apply this protection rule directly in your Linux server terminal:

1. Open your Linux server terminal with administrative superuser privileges.
2. Run the command to create a tracking list for suspicious packets on the SSH port.
3. Save the configuration to ensure the defense remains active after rebooting the machine.

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH_SCANNER -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name SSH_SCANNER -j DROP

In practice, the command above checks if the same IP address tried to initiate four connections on the administration port in under a minute. If the threshold is exceeded, the traffic is dropped silently, making the attacker believe the server has simply vanished from the network or that the port is completely closed.

Mitigating brute-force attacks with rate limits

Beyond fast scans, brute-force attacks tend to be persistent and distributed, firing dozens of attempts per second against authentication services. To neutralize this onslaught without harming legitimate collaborators who might mistype their password, we use the hashlimit module, which imposes a dynamic request ceiling per IP or entire subnet.

This technique complements application-layer solutions, working in perfect harmony with monitoring tools and reactive blocks. If you need to expand your security strategy to other layers, it is worth checking out strategies like how to block malicious IPs in Nginx with fail2ban to build an automated barrier across multiple levels of your server infrastructure.

Final considerations on maintaining robust firewalls

Securing a network infrastructure on Linux requires continuous vigilance, fine-tuning of filtering rules, and a clear understanding of how legitimate traffic interacts with the operating system. By implementing smart state tracking, rigorous control of new connections, and automatic blocking of suspicious scans, we drastically reduce the attack surface exposed on the public internet. Keeping the firewall updated and regularly monitoring logs ensures your environment remains resilient against the constant evolution of automated threats.